opa-golib-python-bindings 0.1.0__tar.gz

opa_golib_python_bindings-0.1.0/.gitignore

@@ -0,0 +1,6 @@
+.venv/
+__pycache__/
+*.pyc
+src/opa_bindings/libopabridge.so
+src/opa_bindings/libopabridge.h
+dist/

opa_golib_python_bindings-0.1.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

opa_golib_python_bindings-0.1.0/Makefile

@@ -0,0 +1,14 @@
+LIB := src/opa_bindings/libopabridge.so
+
+.PHONY: all build test clean
+
+all: build
+
+build:
+	cd go && go mod tidy && go build -buildmode=c-shared -o ../$(LIB) .
+
+test: build
+	python -m pytest tests/ -v
+
+clean:
+	rm -f $(LIB) src/opa_bindings/libopabridge.h

opa_golib_python_bindings-0.1.0/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.5
+Name: opa-golib-python-bindings
+Version: 0.1.0
+Summary: Python bindings for the OPA (Open Policy Agent) Rego engine via a Go c-shared library
+License-File: LICENSE
+Requires-Python: >=3.14
+Provides-Extra: dev
+Requires-Dist: pytest; extra == 'dev'

opa_golib_python_bindings-0.1.0/README.md

@@ -0,0 +1,48 @@
+# opa-golib-python-bindings
+
+Python bindings for the [OPA](https://www.openpolicyagent.org/) Rego engine, embedding
+`github.com/open-policy-agent/opa/v1/rego` via a Go c-shared library and a stdlib-only
+ctypes wrapper.
+
+## Build
+
+Requires Go >= 1.26 and Python >= 3.14.
+
+```sh
+make build   # builds src/opa_bindings/libopabridge.so
+make test    # builds + runs pytest
+```
+
+## Usage
+
+```python
+from opa_bindings import OpaEngine
+
+users = {"alice": {"role": "admin"}}
+
+with OpaEngine() as engine:
+    engine.add_policy("authz.rego", """
+package authz
+
+allow if lookup_user(input.user).role == "admin"
+""")
+    engine.add_data({"admin": ["alice"]}, path="roles")   # deep-merged; conflicts raise
+    engine.register_function("lookup_user", lambda name: users.get(name))
+
+    engine.eval_document("authz.allow", {"user": "alice"})  # -> True
+    engine.eval_query("x = data.roles.admin[_]")            # -> [{"x": "alice"}]
+```
+
+Notes:
+
+- `add_data` deep-merges objects; identical values coexist, conflicting values raise
+  `OpaError(code="merge_conflict")` naming the conflicting path.
+- `register_function` infers arity from the callable's signature. A `*args` function is
+  variadic and is called from Rego with a single array argument: `many(["a", "b"])`
+  (OPA does not support variadic builtins with return values).
+- Builtin arguments and return values are JSON-compatible objects. A callback exception
+  becomes an evaluation error; returning is fine.
+- An undefined document raises `OpaUndefinedError`.
+- Rego `print(...)` output is captured per evaluation: set `engine.print_handler`
+  to a `callable(message, location)` to receive it (default: written to stderr);
+  `engine.last_prints` holds the `(message, location)` pairs of the last eval.

opa_golib_python_bindings-0.1.0/go/bridge.go

@@ -0,0 +1,257 @@
+package main
+
+/*
+#include <stdlib.h>
+
+// Callback provided by the host (Python). It receives the engine handle, the
+// builtin name and the arguments as a JSON array. It returns a pointer to a
+// JSON envelope {"result": ...} or {"error": "..."}. The buffer is owned by
+// the host and must stay valid until the callback is invoked again; the Go
+// side copies it synchronously.
+typedef char* (*opa_callback)(unsigned long long h, char* name, char* argsJson);
+*/
+import "C"
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"sync"
+	"unsafe"
+
+	"github.com/open-policy-agent/opa/v1/ast"
+	"github.com/open-policy-agent/opa/v1/rego"
+	"github.com/open-policy-agent/opa/v1/storage/inmem"
+	"github.com/open-policy-agent/opa/v1/topdown/print"
+)
+
+type printMsg struct {
+	Message  string `json:"message"`
+	Location string `json:"location"`
+}
+
+// printCollector implements print.Hook, collecting print() output per eval.
+type printCollector struct {
+	mu   sync.Mutex
+	msgs []printMsg
+}
+
+func (p *printCollector) Print(pctx print.Context, msg string) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	loc := ""
+	if pctx.Location != nil {
+		loc = pctx.Location.String()
+	}
+	p.msgs = append(p.msgs, printMsg{Message: msg, Location: loc})
+	return nil
+}
+
+type builtinSpec struct {
+	name  string
+	arity int // -1 = variadic
+	cb    C.opa_callback
+}
+
+type engine struct {
+	mu       sync.Mutex
+	modules  map[string]string
+	data     map[string]any
+	builtins []builtinSpec
+	prepared map[string]rego.PreparedEvalQuery
+}
+
+var (
+	registry   = map[uint64]*engine{}
+	registryMu sync.Mutex
+	nextHandle uint64
+)
+
+func getEngine(h C.ulonglong) (*engine, error) {
+	registryMu.Lock()
+	defer registryMu.Unlock()
+	e, ok := registry[uint64(h)]
+	if !ok {
+		return nil, fmt.Errorf("invalid engine handle %d", uint64(h))
+	}
+	return e, nil
+}
+
+func resultJSON(v any) *C.char {
+	b, err := json.Marshal(map[string]any{"result": v})
+	if err != nil {
+		return errorJSON("internal", err.Error())
+	}
+	return C.CString(string(b))
+}
+
+func errorJSON(code, msg string) *C.char {
+	b, _ := json.Marshal(map[string]any{"error": map[string]string{"code": code, "message": msg}})
+	return C.CString(string(b))
+}
+
+//export OpaNew
+func OpaNew() C.ulonglong {
+	registryMu.Lock()
+	defer registryMu.Unlock()
+	nextHandle++
+	registry[nextHandle] = &engine{
+		modules:  map[string]string{},
+		data:     map[string]any{},
+		prepared: map[string]rego.PreparedEvalQuery{},
+	}
+	return C.ulonglong(nextHandle)
+}
+
+//export OpaDestroy
+func OpaDestroy(h C.ulonglong) {
+	registryMu.Lock()
+	defer registryMu.Unlock()
+	delete(registry, uint64(h))
+}
+
+//export OpaFreeString
+func OpaFreeString(s *C.char) {
+	C.free(unsafe.Pointer(s))
+}
+
+//export OpaAddPolicy
+func OpaAddPolicy(h C.ulonglong, path, src *C.char) *C.char {
+	e, err := getEngine(h)
+	if err != nil {
+		return errorJSON("invalid_handle", err.Error())
+	}
+	p, s := C.GoString(path), C.GoString(src)
+	if _, err := ast.ParseModule(p, s); err != nil {
+		return errorJSON("parse_error", err.Error())
+	}
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.modules[p] = s
+	e.prepared = map[string]rego.PreparedEvalQuery{}
+	return resultJSON(true)
+}
+
+//export OpaAddData
+func OpaAddData(h C.ulonglong, dataPath, jsonValue *C.char) *C.char {
+	e, err := getEngine(h)
+	if err != nil {
+		return errorJSON("invalid_handle", err.Error())
+	}
+	var v any
+	if err := json.Unmarshal([]byte(C.GoString(jsonValue)), &v); err != nil {
+		return errorJSON("invalid_json", err.Error())
+	}
+	// Wrap the value in nested objects along dataPath.
+	p := C.GoString(dataPath)
+	segs := []string{}
+	if p != "" {
+		segs = strings.Split(p, ".")
+	}
+	for i := len(segs) - 1; i >= 0; i-- {
+		v = map[string]any{segs[i]: v}
+	}
+	src, ok := v.(map[string]any)
+	if !ok {
+		return errorJSON("merge_conflict", "root data value must be a JSON object")
+	}
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	merged, err := deepMerge(e.data, src, "data")
+	if err != nil {
+		return errorJSON("merge_conflict", err.Error())
+	}
+	e.data = merged
+	e.prepared = map[string]rego.PreparedEvalQuery{}
+	return resultJSON(true)
+}
+
+//export OpaRegisterBuiltin
+func OpaRegisterBuiltin(h C.ulonglong, name *C.char, arity C.int, cb C.opa_callback) *C.char {
+	e, err := getEngine(h)
+	if err != nil {
+		return errorJSON("invalid_handle", err.Error())
+	}
+	n := C.GoString(name)
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for _, b := range e.builtins {
+		if b.name == n {
+			return errorJSON("already_registered", "builtin already registered: "+n)
+		}
+	}
+	e.builtins = append(e.builtins, builtinSpec{name: n, arity: int(arity), cb: cb})
+	e.prepared = map[string]rego.PreparedEvalQuery{}
+	return resultJSON(true)
+}
+
+//export OpaEvalQuery
+func OpaEvalQuery(h C.ulonglong, query, inputJson *C.char) *C.char {
+	return evalCommon(h, C.GoString(query), inputJson)
+}
+
+//export OpaEvalDocument
+func OpaEvalDocument(h C.ulonglong, docPath, inputJson *C.char) *C.char {
+	p := C.GoString(docPath)
+	q := "data"
+	if p != "" {
+		q = "data." + p
+	}
+	return evalCommon(h, q, inputJson)
+}
+
+func evalCommon(h C.ulonglong, query string, inputJson *C.char) *C.char {
+	e, err := getEngine(h)
+	if err != nil {
+		return errorJSON("invalid_handle", err.Error())
+	}
+	e.mu.Lock()
+	pq, ok := e.prepared[query]
+	if !ok {
+		opts := []func(*rego.Rego){
+			rego.Query(query),
+			rego.Store(inmem.NewFromObject(e.data)),
+			rego.StrictBuiltinErrors(true),
+			rego.EnablePrintStatements(true),
+		}
+		for path, src := range e.modules {
+			opts = append(opts, rego.Module(path, src))
+		}
+		for _, b := range e.builtins {
+			opts = append(opts, makeBuiltin(uint64(h), b))
+		}
+		pq, err = rego.New(opts...).PrepareForEval(context.Background())
+		if err != nil {
+			e.mu.Unlock()
+			return errorJSON("prepare_error", err.Error())
+		}
+		e.prepared[query] = pq
+	}
+	e.mu.Unlock()
+
+	evalOpts := []rego.EvalOption{}
+	if inputJson != nil {
+		s := C.GoString(inputJson)
+		if s != "" {
+			var input any
+			if err := json.Unmarshal([]byte(s), &input); err != nil {
+				return errorJSON("invalid_json", err.Error())
+			}
+			evalOpts = append(evalOpts, rego.EvalInput(input))
+		}
+	}
+	collector := &printCollector{}
+	evalOpts = append(evalOpts, rego.EvalPrintHook(collector))
+	rs, err := pq.Eval(context.Background(), evalOpts...)
+	if err != nil {
+		return errorJSON("eval_error", err.Error())
+	}
+	b, err := json.Marshal(map[string]any{"result": rs, "prints": collector.msgs})
+	if err != nil {
+		return errorJSON("internal", err.Error())
+	}
+	return C.CString(string(b))
+}
+
+func main() {}

opa_golib_python_bindings-0.1.0/go/bridge_call.c

@@ -0,0 +1,7 @@
+// Trampoline for invoking the host-provided callback function pointer,
+// since Go cannot call C function pointers directly.
+typedef char* (*opa_callback)(unsigned long long h, char* name, char* argsJson);
+
+char* bridge_call(opa_callback cb, unsigned long long h, char* name, char* args) {
+	return cb(h, name, args);
+}

opa_golib_python_bindings-0.1.0/go/builtins.go

@@ -0,0 +1,91 @@
+package main
+
+/*
+#include <stdlib.h>
+typedef char* (*opa_callback)(unsigned long long h, char* name, char* argsJson);
+char* bridge_call(opa_callback cb, unsigned long long h, char* name, char* args);
+*/
+import "C"
+
+import (
+	"encoding/json"
+	"fmt"
+	"unsafe"
+
+	"github.com/open-policy-agent/opa/v1/ast"
+	"github.com/open-policy-agent/opa/v1/rego"
+	"github.com/open-policy-agent/opa/v1/types"
+)
+
+func makeBuiltin(handle uint64, spec builtinSpec) func(*rego.Rego) {
+	// OPA does not support variadic builtins with a return value, so a
+	// variadic function (arity -1) is declared as taking a single array
+	// argument; the host unpacks it into the callable's *args.
+	nargs := spec.arity
+	if nargs < 0 {
+		nargs = 1
+	}
+	args := make([]types.Type, nargs)
+	for i := range args {
+		args[i] = types.A
+	}
+	decl := types.NewFunction(args, types.A)
+	return rego.FunctionDyn(
+		&rego.Function{
+			Name:             spec.name,
+			Decl:             decl,
+			Nondeterministic: true,
+		},
+		func(_ rego.BuiltinContext, terms []*ast.Term) (*ast.Term, error) {
+			// The terms slice may include a trailing generated output/capture
+			// term that is not an argument; trim to the declared arity.
+			if len(terms) > nargs {
+				terms = terms[:nargs]
+			}
+			args := make([]any, len(terms))
+			for i, t := range terms {
+				v, err := ast.JSON(t.Value)
+				if err != nil {
+					return nil, fmt.Errorf("%s: cannot convert argument %d: %w", spec.name, i, err)
+				}
+				args[i] = v
+			}
+			argsJSON, err := json.Marshal(args)
+			if err != nil {
+				return nil, err
+			}
+			cName := C.CString(spec.name)
+			cArgs := C.CString(string(argsJSON))
+			ret := C.bridge_call(spec.cb, C.ulonglong(handle), cName, cArgs)
+			C.free(unsafe.Pointer(cName))
+			C.free(unsafe.Pointer(cArgs))
+			if ret == nil {
+				return nil, fmt.Errorf("%s: callback returned NULL", spec.name)
+			}
+			// The host owns ret's buffer; copy it, do not free.
+			var envelope struct {
+				Result *json.RawMessage `json:"result"`
+				Error  *string          `json:"error"`
+			}
+			if err := json.Unmarshal([]byte(C.GoString(ret)), &envelope); err != nil {
+				return nil, fmt.Errorf("%s: invalid callback response: %w", spec.name, err)
+			}
+			if envelope.Error != nil {
+				return nil, fmt.Errorf("%s: %s", spec.name, *envelope.Error)
+			}
+			if envelope.Result == nil {
+				// undefined
+				return nil, nil
+			}
+			var v any
+			if err := json.Unmarshal(*envelope.Result, &v); err != nil {
+				return nil, err
+			}
+			val, err := ast.InterfaceToValue(v)
+			if err != nil {
+				return nil, err
+			}
+			return ast.NewTerm(val), nil
+		},
+	)
+}

opa_golib_python_bindings-0.1.0/go/go.mod

@@ -0,0 +1,37 @@
+module opabridge
+
+go 1.26
+
+require github.com/open-policy-agent/opa v1.19.1
+
+require (
+	github.com/agnivade/levenshtein v1.2.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/goccy/go-json v0.10.6 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
+	github.com/lestrrat-go/dsig v1.2.1 // indirect
+	github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
+	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/httprc/v3 v3.0.5 // indirect
+	github.com/lestrrat-go/jwx/v3 v3.1.1 // indirect
+	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
+	github.com/segmentio/asm v1.2.1 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
+	github.com/valyala/fastjson v1.6.10 // indirect
+	github.com/vektah/gqlparser/v2 v2.5.36 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/yashtewari/glob-intersection v0.2.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)

opa_golib_python_bindings-0.1.0/go/go.sum

@@ -0,0 +1,135 @@
+github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
+github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 h1:5RVFMOWjMyRy8cARdy79nAmgYw3hK/4HUq48LQ6Wwqo=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
+github.com/dgraph-io/badger/v4 v4.9.4 h1:bcw+waCpzRZ2nmcSPbnPvDVhiEsn98TKmvnAhK7r7LM=
+github.com/dgraph-io/badger/v4 v4.9.4/go.mod h1:nJjaJTUOSsQEBhsq209FmwCvMJzEA3e74RjZw6V2pQI=
+github.com/dgraph-io/ristretto/v2 v2.2.0 h1:bkY3XzJcXoMuELV8F+vS8kzNgicwQFAaGINAEJdWGOM=
+github.com/dgraph-io/ristretto/v2 v2.2.0/go.mod h1:RZrm63UmcBAaYWC1DotLYBmTvgkrs0+XhBd7Npn7/zI=
+github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54 h1:SG7nF6SRlWhcT7cNTs5R6Hk4V2lcmLz2NsG2VnInyNo=
+github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
+github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
+github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
+github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
+github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/google/flatbuffers v25.2.10+incompatible h1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H/pNX4FP1v0Q=
+github.com/google/flatbuffers v25.2.10+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
+github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=
+github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
+github.com/lestrrat-go/dsig v1.2.1 h1:MwxzZhE4+4fguHi+uDALKVlC3Cn+O1QU1Q/F8D7hVIc=
+github.com/lestrrat-go/dsig v1.2.1/go.mod h1:RD2eOaidyPvpc7IJQoO3Qq52RWdy8ZcJs8lrOnoa1Kc=
+github.com/lestrrat-go/dsig-secp256k1 v1.0.0 h1:JpDe4Aybfl0soBvoVwjqDbp+9S1Y2OM7gcrVVMFPOzY=
+github.com/lestrrat-go/dsig-secp256k1 v1.0.0/go.mod h1:CxUgAhssb8FToqbL8NjSPoGQlnO4w3LG1P0qPWQm/NU=
+github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
+github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
+github.com/lestrrat-go/httprc/v3 v3.0.5 h1:S+Mb4L2I+bM6JGTibLmxExhyTOqnXjqx+zi9MoXw/TM=
+github.com/lestrrat-go/httprc/v3 v3.0.5/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
+github.com/lestrrat-go/jwx/v3 v3.1.1 h1:yd9AdPmZ4INnQ7k42IrzXYpnEG803+SrQ6hdMvzHJzw=
+github.com/lestrrat-go/jwx/v3 v3.1.1/go.mod h1:uw/MN2M/Xiu4FhwcIwH11Zsh9JWx9SWzgALl7/uIEkU=
+github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=
+github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg=
+github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
+github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/open-policy-agent/opa v1.19.1 h1:aB1nOncChnTbQurjRQVJnjTJxditt8VqszlbaM3GGKU=
+github.com/open-policy-agent/opa v1.19.1/go.mod h1:pb6Y6klyf7X7X8uXNDflruA9dQC2gMqWROXI5w/kvv0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI=
+github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
+github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 h1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg=
+github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
+github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
+github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc=
+github.com/tchap/go-patricia/v2 v2.3.3/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
+github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=
+github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
+github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=
+github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE=
+github.com/vektah/gqlparser/v2 v2.5.36 h1:CN9mKVHgMkc+XftdOWIhb4HEL8wKSYkFAqhf8booa7s=
+github.com/vektah/gqlparser/v2 v2.5.36/go.mod h1:cAJ9qwVgPaUkWv6Gn8vn0mqOE0Ui5Pn56wNy5396XWo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/yashtewari/glob-intersection v0.2.0 h1:8iuHdN88yYuCzCdjt0gDe+6bAhUwBeEWqThExu54RFg=
+github.com/yashtewari/glob-intersection v0.2.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

opa_golib_python_bindings-0.1.0/go/merge.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"fmt"
+	"reflect"
+)
+
+// deepMerge merges src into dst, returning the merged object. Objects merge
+// recursively; identical non-object values are kept; anything else is a
+// conflict reported with its path.
+func deepMerge(dst, src map[string]any, path string) (map[string]any, error) {
+	out := make(map[string]any, len(dst)+len(src))
+	for k, v := range dst {
+		out[k] = v
+	}
+	for k, sv := range src {
+		p := path + "." + k
+		dv, exists := out[k]
+		if !exists {
+			out[k] = sv
+			continue
+		}
+		dm, dIsObj := dv.(map[string]any)
+		sm, sIsObj := sv.(map[string]any)
+		switch {
+		case dIsObj && sIsObj:
+			merged, err := deepMerge(dm, sm, p)
+			if err != nil {
+				return nil, err
+			}
+			out[k] = merged
+		case reflect.DeepEqual(dv, sv):
+			// identical values, keep as-is
+		default:
+			return nil, fmt.Errorf("conflicting values at %s: cannot merge %T with %T", p, dv, sv)
+		}
+	}
+	return out, nil
+}

opa_golib_python_bindings-0.1.0/hatch_build.py

@@ -0,0 +1,21 @@
+"""Hatchling build hook: compile the Go bridge and tag the wheel per-platform."""
+
+import os
+import subprocess
+import sysconfig
+
+from hatchling.builders.hooks.plugin.interface import BuildHookInterface
+
+
+class CustomBuildHook(BuildHookInterface):
+    def initialize(self, version, build_data):
+        if self.target_name != "wheel":
+            return
+        subprocess.run(["make", "build"], check=True, cwd=self.root)
+        build_data["pure_python"] = False
+        # The wheel is Python-version independent but platform specific.
+        # OPA_BINDINGS_PLAT overrides the tag in CI (e.g. macosx_11_0_arm64).
+        plat = os.environ.get("OPA_BINDINGS_PLAT") or (
+            sysconfig.get_platform().replace("-", "_").replace(".", "_")
+        )
+        build_data["tag"] = f"py3-none-{plat}"

opa_golib_python_bindings-0.1.0/pyproject.toml

@@ -0,0 +1,35 @@
+[project]
+name = "opa-golib-python-bindings"
+version = "0.1.0"
+description = "Python bindings for the OPA (Open Policy Agent) Rego engine via a Go c-shared library"
+requires-python = ">=3.14"
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["pytest"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/opa_bindings"]
+artifacts = ["src/opa_bindings/libopabridge.so"]
+
+[tool.hatch.build.targets.wheel.hooks.custom]
+path = "hatch_build.py"
+
+[tool.hatch.build.targets.sdist]
+include = [
+  "src/opa_bindings",
+  "go/*.go",
+  "go/*.c",
+  "go/go.mod",
+  "go/go.sum",
+  "Makefile",
+  "hatch_build.py",
+  "README.md",
+]
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]

opa_golib_python_bindings-0.1.0/src/opa_bindings/__init__.py

@@ -0,0 +1,3 @@
+from .engine import OpaEngine, OpaError, OpaUndefinedError
+
+__all__ = ["OpaEngine", "OpaError", "OpaUndefinedError"]

opa_golib_python_bindings-0.1.0/src/opa_bindings/_native.py

@@ -0,0 +1,51 @@
+"""ctypes bindings for the Go c-shared bridge library."""
+
+import ctypes
+from pathlib import Path
+
+_LIB_PATH = Path(__file__).parent / "libopabridge.so"
+
+# char* (*opa_callback)(unsigned long long h, char* name, char* argsJson)
+# Return type is c_void_p so ctypes does not copy/free: the Python side keeps
+# the returned buffer alive until the callback is invoked again, and Go copies
+# it synchronously.
+CALLBACK = ctypes.CFUNCTYPE(
+    ctypes.c_void_p, ctypes.c_uint64, ctypes.c_char_p, ctypes.c_char_p
+)
+
+
+def load():
+    lib = ctypes.CDLL(str(_LIB_PATH))
+
+    lib.OpaNew.restype = ctypes.c_uint64
+    lib.OpaNew.argtypes = []
+
+    lib.OpaDestroy.restype = None
+    lib.OpaDestroy.argtypes = [ctypes.c_uint64]
+
+    lib.OpaFreeString.restype = None
+    lib.OpaFreeString.argtypes = [ctypes.c_void_p]
+
+    # Fallible calls return a malloc'd char* envelope; declare as c_void_p so
+    # we can free it after copying.
+    lib.OpaAddPolicy.restype = ctypes.c_void_p
+    lib.OpaAddPolicy.argtypes = [ctypes.c_uint64, ctypes.c_char_p, ctypes.c_char_p]
+
+    lib.OpaAddData.restype = ctypes.c_void_p
+    lib.OpaAddData.argtypes = [ctypes.c_uint64, ctypes.c_char_p, ctypes.c_char_p]
+
+    lib.OpaRegisterBuiltin.restype = ctypes.c_void_p
+    lib.OpaRegisterBuiltin.argtypes = [
+        ctypes.c_uint64,
+        ctypes.c_char_p,
+        ctypes.c_int,
+        CALLBACK,
+    ]
+
+    lib.OpaEvalQuery.restype = ctypes.c_void_p
+    lib.OpaEvalQuery.argtypes = [ctypes.c_uint64, ctypes.c_char_p, ctypes.c_char_p]
+
+    lib.OpaEvalDocument.restype = ctypes.c_void_p
+    lib.OpaEvalDocument.argtypes = [ctypes.c_uint64, ctypes.c_char_p, ctypes.c_char_p]
+
+    return lib

opa_golib_python_bindings-0.1.0/src/opa_bindings/engine.py

@@ -0,0 +1,196 @@
+"""High-level Python API around the Go/OPA bridge library."""
+
+import ctypes
+import inspect
+import json
+import sys
+
+from . import _native
+
+
+class OpaError(Exception):
+    def __init__(self, code: str, message: str):
+        super().__init__(f"{code}: {message}")
+        self.code = code
+        self.message = message
+
+
+class OpaUndefinedError(OpaError):
+    def __init__(self, what: str):
+        super().__init__("undefined", f"{what} is undefined")
+
+
+_lib = None
+
+
+def _get_lib():
+    global _lib
+    if _lib is None:
+        _lib = _native.load()
+    return _lib
+
+
+class OpaEngine:
+    """An embedded OPA policy engine instance.
+
+    Policies are Rego modules added under a path, data is deep-merged JSON,
+    and Python callables can be registered as custom Rego builtins.
+    """
+
+    def __init__(self):
+        self._lib = _get_lib()
+        self._handle = self._lib.OpaNew()
+        self._functions = {}
+        # Buffers returned to Go must outlive the call; Go copies them
+        # synchronously, so keeping the latest buffer per builtin suffices.
+        self._callback_buffers = {}
+        self._trampoline = _native.CALLBACK(self._dispatch)
+        #: Called as ``print_handler(message, location)`` for each Rego
+        #: ``print(...)`` during evaluation; None writes them to stderr.
+        self.print_handler = None
+        #: Prints captured by the most recent eval, as (message, location).
+        self.last_prints = []
+
+    # -- lifecycle -----------------------------------------------------
+
+    def close(self):
+        if self._handle is not None:
+            self._lib.OpaDestroy(self._handle)
+            self._handle = None
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        self.close()
+
+    def __del__(self):
+        try:
+            self.close()
+        except Exception:
+            pass
+
+    # -- internals -----------------------------------------------------
+
+    def _check_open(self):
+        if self._handle is None:
+            raise OpaError("closed", "engine has been closed")
+
+    def _call(self, fn, *args):
+        ptr = fn(self._handle, *args)
+        if not ptr:
+            raise OpaError("internal", "native call returned NULL")
+        try:
+            raw = ctypes.string_at(ptr)
+        finally:
+            self._lib.OpaFreeString(ptr)
+        envelope = json.loads(raw)
+        if "error" in envelope and envelope["error"] is not None:
+            err = envelope["error"]
+            raise OpaError(err.get("code", "unknown"), err.get("message", ""))
+        return envelope
+
+    def _eval_result(self, envelope):
+        self.last_prints = [
+            (p["message"], p["location"]) for p in envelope.get("prints") or []
+        ]
+        for message, location in self.last_prints:
+            if self.print_handler is not None:
+                self.print_handler(message, location)
+            else:
+                print(f"{location}: {message}", file=sys.stderr)
+        return envelope.get("result")
+
+    def _dispatch(self, handle, name, args_json):
+        name = name.decode()
+        try:
+            fn, arity = self._functions[name]
+            args = json.loads(args_json)
+            if arity == -1:
+                # Variadic builtins take a single array argument in Rego.
+                args = args[0]
+            response = {"result": fn(*args)}
+        except Exception as e:  # never let an exception cross into Go
+            response = {"error": repr(e)}
+        try:
+            buf = ctypes.create_string_buffer(json.dumps(response).encode())
+        except Exception as e:
+            buf = ctypes.create_string_buffer(
+                json.dumps({"error": f"unserializable result: {e!r}"}).encode()
+            )
+        self._callback_buffers[name] = buf
+        return ctypes.addressof(buf)
+
+    # -- public API ----------------------------------------------------
+
+    def add_policy(self, path: str, source: str):
+        """Add a Rego module under the given path (module name)."""
+        self._check_open()
+        self._call(self._lib.OpaAddPolicy, path.encode(), source.encode())
+
+    def add_data(self, value, path: str = ""):
+        """Deep-merge a JSON-compatible value into the data document.
+
+        ``path`` is a dotted path (e.g. ``"roles.admin"``); empty means root.
+        Conflicting existing values raise OpaError(code="merge_conflict").
+        """
+        self._check_open()
+        self._call(self._lib.OpaAddData, path.encode(), json.dumps(value).encode())
+
+    def register_function(self, name: str, fn, *, arity: int | None = None):
+        """Expose a Python callable as a Rego builtin.
+
+        Arity is inferred from the signature unless given; ``*args`` means
+        variadic, in which case the builtin takes a single array argument in
+        Rego (e.g. ``many(["a", "b"])``) that is unpacked into ``*args``.
+        Arguments and the return value are JSON-compatible objects.
+        """
+        self._check_open()
+        if arity is None:
+            arity = 0
+            for p in inspect.signature(fn).parameters.values():
+                if p.kind is inspect.Parameter.VAR_POSITIONAL:
+                    arity = -1
+                    break
+                if p.kind in (
+                    inspect.Parameter.POSITIONAL_ONLY,
+                    inspect.Parameter.POSITIONAL_OR_KEYWORD,
+                ):
+                    arity += 1
+        self._functions[name] = (fn, arity)
+        try:
+            self._call(
+                self._lib.OpaRegisterBuiltin, name.encode(), arity, self._trampoline
+            )
+        except Exception:
+            del self._functions[name]
+            raise
+
+    def eval_query(self, query: str, input=None):
+        """Evaluate a Rego query; returns a list of binding dicts."""
+        self._check_open()
+        rs = self._eval_result(
+            self._call(self._lib.OpaEvalQuery, query.encode(), _encode_input(input))
+        )
+        if not rs:
+            return []
+        return [r.get("bindings", {}) for r in rs]
+
+    def eval_document(self, path: str, input=None):
+        """Evaluate the document at ``data.<path>`` and return its value.
+
+        Raises OpaUndefinedError if the document is undefined.
+        """
+        self._check_open()
+        rs = self._eval_result(
+            self._call(self._lib.OpaEvalDocument, path.encode(), _encode_input(input))
+        )
+        if not rs or not rs[0].get("expressions"):
+            raise OpaUndefinedError(f"data.{path}" if path else "data")
+        return rs[0]["expressions"][0]["value"]
+
+
+def _encode_input(input):
+    if input is None:
+        return b""
+    return json.dumps(input).encode()